~ / search / GHSA-49xc-52mp-cc9j

GHSA-49xc-52mp-cc9j

nimiq-blockchain is missing a wall-clock upper bound on block timestamps

Source: GitHub Advisory Database (reviewed) Critical CVE-2026-40093

Packages

EcosystemPackageAffectedFixed in
crates.io nimiq-blockchain <= 1.3.0 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact Block timestamp validation enforces that `timestamp >= parent.timestamp` for non-skip blocks and `timestamp == parent.timestamp + MIN_PRODUCER_TIMEOUT` for skip blocks, but there is no visible upper bound check against the wall clock. A malicious block-producing validator can set block timestamps arbitrarily far in the future. This directly affects reward calculations via `Policy::supply_at()` and `batch_delay()` in `blockchain/src/reward.rs`, inflating the monetary supply beyond the intended emission schedule. ### Patches TBD ### Workarounds No know workarounds.

References

External links from the advisory. They lead to third-party sites.